Re: [Add] I-D Action: draft-reddy-add-enterprise-split-dns-08.txt

[Ben Schwartz <[e-mail]>]

On Sun, Jan 23, 2022 at 4:09 AM Ralf Weber <[e-mail]> wrote:

> Moin!
>
> On 22 Jan 2022, at 1:15, Ben Schwartz wrote:
> > I don't understand the question.  These names are properly rooted in the
> > DNS, so DNSSEC validation of signed zones proceeds as usual, without any
> > need for additional trust anchors.
> That only is true if you are using the same DNSKEYs internally and
> external.
> Something that might not be true if you e.g have your external zone hosted
> by a third party.
>

I think this is fine.  You just publish DS records for both the internal
and external DNSKEYs.  Validation will then succeed for records signed by
either key.

Also keep in mind that if
>         corp.example.com
> is NXDomain externally you need a special/different
>         example.com
> internally to delegate corp.example.com.
>

Agreed.  The claimed zone (which could be "example.com" or "corp.example.com")
must resolve differently internally and externally, or you haven't actually
"split" anything.

I’ve always envisioned DNSSEC split horizon needing an internal trust anchor
> because of this ideally in the recursive resolver and stub resolver.
>

I don't think there's any need for a separate trust anchor.